I'm having the same problem.
I've tried adding <?php echo JHtml::_('form.token');?> to line 28, and it still shows 'INVALID TOKEN' message.
I'm sending my review.php file so that you can see if there is something wrong.